fortigate 80c smtp blocking

[Fabian]

Dear guys, we recently took over it support for a customer which is using a fortigate 80C. However I am not very familiar with this and need some help. Everytime when someone is sending a huge amount of emails (>25 at the same time) the connection to the mail server is dropped and the whole company is unable to send emails for up to 1 hour. Sometimes less. I am wondering if this can be caused by the firewall? Is there a function that could cause this? The mail server is outsourced and the owner tells me that everything is fine on their site. What do you guys think? BR Fabian

[ede_pfau]

Hi, and welcome to the forums. Yes, this can be caused by an IPS sensor. There should be entries in the logs showing you an alert that someone is spamming. In combination with ' quarantine source address' this could block outgoing traffic for more than just one PC. To test: create a new policy ABOVE all others, with source=LAN, dest=external mail server, service=ANY, action=ACCEPT. Customize the policy table display to show ' Count' as well as the usual columns. Wait until you see Count > 0 bytes. What do you gain by this? - you can confirm that this policy is hit - as there are no UTM measures configured in this new policy there is no way the FGT could block traffic Then, send 50 eMails to yourself to test.

[Fabian]

thank you very much for your help. I have created the policy but it didnt help. When I send 50 mails I get a timeout at around 40. Its very weird.

[rwpatterson]

I would look towards the ISP. Even though all is ' fine' , you may have gotten a lower level support staff that is unaware of limits on their email server configuration. I would definitely dig deeper into the ISP. My two cents As a test, create a policy for the mail server with only NAT, no other filtering. Place it at the top of the list of outgoing policies and send the same batch of emails. If you still get the timeout, the problem is outside the Fortigate.

[Fabian]

yes, I will definitely do that. However I just did a test and changed the smtp server to our own one and everything is fine now. So I can be sure now that the problem is on the mail server side. Thanks.